| #1 | AnyComment | 17 | 445 | 449 | 5k+ | | | Output is not escaped |
| #2 | Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) | 19 | 536 | 379 | 3m+ | | | Missing Translators Comment |
| #3 | Membership Plugin – Kadence Memberships | 19 | 5,082 | 2,982 | 9k+ | | | Text Domain Mismatch |
| #4 | Filter Everything — WordPress & WooCommerce Filters | 21 | 643 | 933 | 50k+ | | | Non-prefixed global variable |
| #5 | WP Extended – The Ultimate WordPress Toolkit | 21 | 1,253 | 398 | 600 | | | Non Singular String Literal Domain |
| #6 | Directorist: AI-Powered Business Directory, Listings & Classified Ads | 22 | 560 | 2,202 | 20k+ | | | Non-prefixed global variable |
| #7 | CLUEVO LMS, E-Learning Platform | 23 | 1,843 | 1,176 | 400 | | | Text Domain Mismatch |
| #8 | Photo Gallery by 10Web – Mobile-Friendly Image Gallery | 23 | 4,159 | 1,553 | 100k+ | | | Output is not escaped |
| #9 | Site Reviews | 23 | 1,626 | 604 | 60k+ | | | Output is not escaped |
| #10 | Slider by 10Web – Responsive Image Slider | 23 | 5,814 | 976 | 10k+ | | | Output is not escaped |
| #11 | WP Crowdfunding | 23 | 199 | 1,629 | 2k+ | | | Non-prefixed global variable |
| #12 | Track, Analyze & Optimize by WP Tao | 23 | 895 | 756 | 600 | | | Output is not escaped |
| #13 | BrikPanel: WooCommerce Dashboard, Abandoned Cart Recovery, Google Sheets Sync, Inventory Management & Bulk Editor | 24 | 4,525 | 1,524 | 700 | | | Text Domain Mismatch |
| #14 | Customer Reviews for WooCommerce | 24 | 2,202 | 2,441 | 80k+ | | | Output is not escaped |
| #15 | Event Tickets and Registration | 24 | 3,407 | 4,217 | 90k+ | | | Non-prefixed global variable |
| #16 | Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | 24 | 4,745 | 1,279 | 30k+ | | | Non Singular String Literal Domain |
| #17 | Infinite Uploads – Offload Media and Video to Cloud Storage | 24 | 586 | 722 | 800 | | | Direct Query |
| #18 | PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes | 24 | 422 | 601 | 10k+ | | | Missing Translators Comment |
| #19 | SecuPress with Simple SSL – Simple and Performant Security | 24 | 1,695 | 1,600 | 40k+ | | | Non-prefixed global variable |
| #20 | XT Ajax Add To Cart for WooCommerce | 24 | 985 | 1,665 | 1k+ | | | Non-prefixed global variable |
| #21 | XT Variation Swatches for WooCommerce | 24 | 1,033 | 1,809 | 500 | | | Non-prefixed global variable |
| #22 | Participants Database | 25 | 941 | 893 | 7k+ | | | SQL query is not prepared |
| #23 | Simply Static – The Static Site Generator | 25 | 190 | 534 | 30k+ | | | Non-prefixed hook name |
| #24 | Affiliate Program Suite — SliceWP Affiliates | 25 | 1,291 | 2,089 | 10k+ | | | Output is not escaped |
| #25 | Smart Image Resize for WooCommerce | 25 | 582 | 404 | 7k+ | | | Text Domain Mismatch |
| #26 | Themify Event Post | 25 | 390 | 146 | 3k+ | | | Output is not escaped |
| #27 | XT Floating Cart for WooCommerce | 25 | 1,232 | 1,985 | 4k+ | | | Non-prefixed global variable |
| #28 | XT Quick View for WooCommerce | 25 | 1,062 | 1,798 | 400 | | | Non-prefixed global variable |
| #29 | Fluent Support – Helpdesk & Customer Support Ticket System | 26 | 92 | 272 | 10k+ | | | Direct Query |
| #30 | URL Image Importer – Import External Images to the Media Library from URL, CSV & XML | 26 | 144 | 239 | 800 | | | Missing nonce verification |
| #31 | Order Tracking – WordPress Status Tracking Plugin | 28 | 619 | 773 | 3k+ | | | Unsafe printing function |
| #32 | Big File Uploads – Increase Maximum File Upload Size | 32 | 70 | 107 | 100k+ | | | Input is not sanitized |
| #33 | DHL eCommerce (Benelux) for WooCommerce | 33 | 221 | 330 | 2k+ | | | Nonce verification recommended |
| #34 | Sessions | 33 | 196 | 103 | 800 | | | Output is not escaped |
| #35 | CartBounty – Save and recover abandoned carts for WooCommerce | 33 | 370 | 399 | 10k+ | | | Output is not escaped |
| #36 | Event Calendar Newsletter | 34 | 96 | 167 | 600 | | | Non-prefixed hook name |
| #37 | HTML Import 2 | 34 | 273 | 26 | 5k+ | | | Unsafe printing function |
| #38 | Seriously Simple Stats | 34 | 99 | 126 | 5k+ | | | Output is not escaped |
| #39 | Donation Platform for WooCommerce: Fundraising & Donation Management | 34 | 331 | 448 | 7k+ | | | Non-prefixed global variable |
| #40 | SX User Name Security | 46 | 42 | 9 | 900 | | | Output is not escaped |
| #41 | WP User Groups | 49 | 44 | 32 | 600 | | | Missing Translators Comment |
| #42 | Bulk edit publish date | 62 | 11 | 16 | 1k+ | | | Nonce verification recommended |